[dependabot]

Bumps jpmcb/prow-github-actions from 3.4.0 to 3.5.0.

Release notes

Sourced from jpmcb/prow-github-actions's releases.

prow-github-actions 3.5.0

v3.5.0

A hardening release: authorization gaps closed, commands that fail now say so, fewer GitHub API calls per event, and an App server that survives bad input, slow handlers and rolling updates. @v3 callers get it automatically; @v3.4.0 pins move to @v3.5.0.

Commands

• Authorization. /unassign @user and /uncc @user now require the commenter to be an org member or repository collaborator (self-unassign and self-uncc are unchanged). /remove refuses lgtm, approved, hold and do-not-merge/* labels and points to the cancel command. Commands run only on a created comment; editing an old comment no longer re-runs it.
• Exclusive label families (/priority, /lifecycle, /stage, /status, exclusive: true) take one value; /priority low high is refused and the issue is left untouched.
• Exact cancel matching. /lgtm cancel, /hold cancel and /approve cancel are a cancel only when the whole argument is cancel; a sentence that merely contains the word no longer removes a label. LGTM on a repository that spells the label that way now cancels.
• Refusals are reported. A refused /close, /reopen, /retitle or self /assign fails the run with <user> is not authorized to …, like /lock and /milestone; when several commands in one comment fail, every failure is reported. /approve, /cc and /uncc on an issue reply that they only apply to pull requests.
• /milestone pages through all open milestones; /retitle validates its title (1–256 chars).

Plugins and cron jobs

• One bad item no longer aborts the run: the sweep, tide, blunderbuss, the lgtm cron and the App's per-installation schedule each isolate per-item failures and continue.
• The bot resolves its own identity from the token instead of assuming github-actions[bot], so under a GitHub App tide dequeues the entries it enqueued, /approve cancel finds its own review, and the approve plugin ignores its own label writes.
• blunderbuss skips users who already reviewed and counts requested teams toward max_request_count. OWNERS rules survive a truncated tree listing. A deleted fork (head.repo: null) is treated as a fork. merge-method is trimmed, case-insensitive, and an unknown value warns before falling back to merge.
• Fewer and parallel API calls: auth checks, the comment thread, the root OWNERS and the Octokit client are memoized per run; config probes, OWNERS probes and label removals run concurrently.

App server (beta)

• POST /webhook is capped at 25 MB (413); App-level events with no repository get 202 ignored instead of a 400; a failed delivery is forgotten so GitHub's redelivery runs it again (Node, Redis and Cloudflare KV stores alike).
• Redis locks renew while a handler runs; waiters back off with jitter; /readyz answers 503 whenever Redis is not ready and during the PROW_SHUTDOWN_DRAIN_MS drain on SIGTERM.
• Cloudflare Worker: one platform scope per isolate, a real per-pull-request lock in the Durable Object, a retrying queue path with a dead-letter queue (prow-jobs-dlq), and tokens minted only where they are read.

Upgrading

... (truncated)

Commits

• a192ee1 chore: release v3.5.0 (#656)
• d2d5a30 chore(deps): pin the vulnerable transitive dev dependencies past their adviso...
• 3c200d1 chore(deps-dev): bump @​antfu/eslint-config from 9.5.1 to 10.0.0 (#646)
• e62e11a chore(deps-dev): bump the dev-dependencies group across 1 directory with 2 up...
• 72ab087 docs: refresh the mutation-survivor table's hold.ts lines after the platform ...
• c2d332a chore(mutation): add tide.ts and mergeQueue.ts to the nightly Stryker set (#651)
• 137ae98 fix(worker): forget failed webhook delivery claims (#654)
• 03e8bac fix(worker): one platform scope per isolate, a real per-PR lock in the Durabl...
• 1f0b606 fix(app): resolve the bot's own identity instead of assuming github-actions[b...
• 21263ce fix(app): bound the webhook body, two-phase dedupe, renewable locks, honest r...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: ce8a6635-1f49-4df0-ac56-917c81b256f4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA c3db752.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
actions/jpmcb/prow-github-actions	3.5.0	🟢 5.8	Details Check Score Reason Code-Review 🟢 5 Found 1/2 approved changesets -- score normalized to 5 Maintained 🟢 10 30 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases 🟢 10 2 out of the last 2 releases have a total of 2 signed artifacts. Security-Policy ⚠️ 0 security policy file not detected Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• .github/workflows/label.yml

[iranzo]

@dependabot merge

[mergify]

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.